secure transfer between login form and server in php

Question

how can i implement a secure transfer from login form on client to server in php? i mean coding password and user ,something except using https.

Answer 1

Use HTTPS.

... something except using https.

Er, hm.

Why are you avoiding SSL? It's really the most simple, straightforward way to do what you're trying to do.

Answer 2

You may encrypt (MD5/SHA etc) your password on the client side using some salt value before sending it to the server. However this is for sure not the best approach. This is just better than sending it plain text. Prefer https.

Answer 3

HTTP Digest authentication can work without requiring SSL.

But it has the same problems as other HTTP authentication. E.g. there's no logout function, you can't control the look & feel of the login UI, no integration between login credentials and your application-specific user account data, etc.

I agree with @Charles -- just use HTTPS when sending sensitive data.

---

Re your comment:

At the start of your login.php script, check if the request is https and if not then redirect to the correct url.

if (!isset($_SERVER["HTTPS"])) {
  header("Location: https://mydomain.com/login.php");
}

Alternatively you could use an Apache rewrite rule:

RewriteEngine On
RewriteCond %{SERVER_PORT} !^443$
RewriteRule ^/(login.php) https://%{SERVER_NAME}/$1 [L,R]

Also, remember that you don't care if the client read the page with the login form with plain http. You care if the client submits the form insecurely, because that's the request that contains the user's password. So the above advice applies if login.php is the script that processes the login form.